PT-2025-44451 · Ibm · Ibm Tivoli Monitoring

Aleksandr Tlyapov · Published 2025-10-30 · Updated 2025-11-07 · CVE-2025-3356

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Tivoli Monitoring versions 6.3.0.7 through 6.3.0.7 Service Pack 21

Description The software contains a directory traversal flaw. A remote attacker can exploit this by sending specially crafted URL requests containing "dot dot" sequences (../) to view, overwrite, or append to arbitrary files on the system. The vulnerability allows manipulation of URL requests to traverse directories, potentially enabling unauthorized access to files within the server’s filesystem.

Recommendations Versions prior to 6.3.0.7 Service Pack 22 should be updated.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3356

Affected Products

Ibm Tivoli Monitoring

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3356 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3356 · Vendor Advisory
• https://twitter.com/CVEnew/status/1983984919610044715 · Twitter Post
• https://t.me/CVEtracker/36228 · Telegram Post
• https://t.me/cveNotify/142051 · Telegram Post
• https://ibm.com/support/pages/node/7249694 · Patch, Vendor Advisory
• https://twitter.com/CveFindCom/status/1983997464311943422 · Twitter Post
• https://twitter.com/CveTodo/status/1983994446162096592 · Twitter Post